Prevention, Detection, Vigilance: A Three-Step Plan to Find Network Weak Spots Before Attackers Do

Every network has a weak point somewhere, and the job is to find it first. That is the starting premise of Keith Bromley, senior solutions marketing manager at Keysight Technologies. Reducing security risk is one of the questions network security staff think about most, he notes, and it matters for small organisations as much as large ones. The harder part is knowing where the exposure lies, and fixing it before a hacker takes advantage.

Bromley's answer is a plan in three parts, meant to surface intrusions and bring network risk down:

• Prevention: keep as many attacks as possible from getting into the network.
• Detection: locate intrusions already inside the network and remediate them fast.
• Vigilance: test defences at regular intervals to confirm they really are detecting and blocking threats.

Prevention starts inline

Bromley describes inline security as one of the highest-impact measures a business can put in place. In his figures, such solutions can remove 90% or more of incoming threats before they reach the network. An inline architecture will not stop every attack, he concedes, but it gives security operations (SecOps) teams the data access they need to bring the real volume of threats down to a level they can handle.

He is careful to say that inline security means more than installing a security appliance such as an intrusion prevention system (IPS) or a web application firewall (WAF). It also calls for external bypass switches and network packet brokers (NPBs), which provide access to the traffic and full visibility of the data. With those in place, every piece of data can be inspected for suspicious traffic.

Assume something gets in, and go looking for it

Inline protection is essential for lowering the chance of an intrusion, but Bromley is frank that something harmful will still find its way in. A second layer of defence is therefore needed, one that searches actively for threats, and that depends on complete visibility across every segment of the network.

Visibility equipment varies in quality, he warns. Security tools may not be seeing everything they should, and an organisation could be missing more than 60% of its threats without realising it. The reason, according to Bromley, is that some vendors of visibility equipment such as NPBs drop packets, with no alert, before the data gets to critical tools like an intrusion detection system (IDS). That missing data plays a large part in why attacks succeed.

Taps, bypass switches and NPBs used together give an organisation the visibility, and the confidence, that it is seeing every bit, byte and packet on its network. With that level of coverage, threat hunting tools and security information and event management (SIEM) systems can search proactively for indicators of compromise (IOC).

Keep testing whether the defences work

The third layer is regular validation that the security architecture performs as intended. For this, Bromley recommends a breach and attack simulation (BAS) solution, which checks defences safely against real-world threats.

Routine patching and a yearly penetration test are good practice, he says, but they are no substitute for BAS-style checks run weekly or monthly. A patch may have been missed, or applied wrongly, and there may be no way of knowing. A penetration test reflects one moment only; a few weeks or months later, new weaknesses are likely to have appeared. And if a test did uncover a vulnerability, it is not certain the correct fix was applied. For all these reasons, Bromley argues, a BAS solution is needed to establish how strong the defences are right now.

Updating security tools is worthwhile, in his view, but constant vigilance does a great deal to keep an organisation secure, and the three-step plan is his way of making sure those tools protect it both today and later on.